-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix numerous message parsing issues (v2) #3113
Commits on Dec 15, 2023
-
pytest: raise on malformed test fixtures
and unbreak test depending on backslash escape
Configuration menu - View commit details
-
Copy full SHA for 559caf9 - Browse repository at this point
Copy the full SHA 559caf9View commit details -
RFC compliant header field+chunk validation
* update HEADER_RE and HEADER_VALUE_RE to match the RFCs * update chunk length parsing to disallow 0x prefix and digit-separating underscores.
Configuration menu - View commit details
-
Copy full SHA for 2dbe49d - Browse repository at this point
Copy the full SHA 2dbe49dView commit details -
Configuration menu - View commit details
-
Copy full SHA for 735e9e8 - Browse repository at this point
Copy the full SHA 735e9e8View commit details -
RFC compliant request line and header parsing
- Unify HEADER_RE and METH_RE - Replace CRLF with SP during obs-fold processing (See RFC 9112 Section 5.2, last paragraph) - Stop stripping header names. - Remove HTAB in OWS in header values that use obs-fold (See RFC 9112 Section 5.2, last paragraph) - Use fullmatch instead of search, which has problems with empty strings. (See GHSA-68xg-gqqm-vgj8) - Split proxy protocol line on space only. (See proxy protocol Section 2.1, bullet 3) - Use fullmatch for method and version (Thank you to Paul Dorn for noticing this.) - Replace calls to str.strip() with str.strip(' \t') - Split request line on SP only. Co-authored-by: Paul Dorn <pajod@users.noreply.github.com>
Configuration menu - View commit details
-
Copy full SHA for 72238fc - Browse repository at this point
Copy the full SHA 72238fcView commit details -
Configuration menu - View commit details
-
Copy full SHA for f0c91cc - Browse repository at this point
Copy the full SHA f0c91ccView commit details -
Configuration menu - View commit details
-
Copy full SHA for 13027ef - Browse repository at this point
Copy the full SHA 13027efView commit details -
Configuration menu - View commit details
-
Copy full SHA for 42dd419 - Browse repository at this point
Copy the full SHA 42dd419View commit details -
strict: header field validation: stop casefolding
* refusing lowercase and ASCII 0x23 (#) had been partially enforced before * do not casefold by default, HTTP methods are case sensitive
Configuration menu - View commit details
-
Copy full SHA for b284678 - Browse repository at this point
Copy the full SHA b284678View commit details -
silently drop or refuse header names w/ underscore
Ambiguous mappings open a bottomless pit of "what is user input and what is proxy input" confusion. Default to what everyone else has been doing for years now, silently drop. see also https://nginx.org/r/underscores_in_headers
Configuration menu - View commit details
-
Copy full SHA for 72b8970 - Browse repository at this point
Copy the full SHA 72b8970View commit details -
unconditionally log request error
Somehow exception logging was conditional on successful request uri parsing. Add it back for the other branch.
Configuration menu - View commit details
-
Copy full SHA for 0b10cba - Browse repository at this point
Copy the full SHA 0b10cbaView commit details -
fail-safe on unsupported request framing
If we promise wsgi.input_terminated, we better get it right - or not at all. * chunked encoding on HTTP <= 1.1 * chunked not last transfer coding * multiple chinked codings * any unknown codings (yes, this too! because we do not detect unusual syntax that is still chunked) * empty coding (plausibly harmless, but not see in real life anyway - refused, for the moment)
2Configuration menu - View commit details
-
Copy full SHA for ac29c9b - Browse repository at this point
Copy the full SHA ac29c9bView commit details -
Ignore secure_scheme_headers in Trailer section
In common configuration unlikely a big security problem in itself you are just fooling the remote about https. However, it is offers an oracle for otherwise invisible proxy request headers, so it might help exploiting other vulnerabilities.
Configuration menu - View commit details
-
Copy full SHA for fd67112 - Browse repository at this point
Copy the full SHA fd67112View commit details -
strict HTTP header field name validation
Do the validation on the original, not the result from unicode case folding. Background: latin-1 0xDF is traditionally uppercased 0x53+0x53 which puts it back in ASCII
Configuration menu - View commit details
-
Copy full SHA for f550111 - Browse repository at this point
Copy the full SHA f550111View commit details -
strict HTTP version validation
Note: This is unrelated to a reverse proxy potentially talking HTTP/3 to clients. This is about the HTTP protocol version spoken to Gunicorn, which is HTTP/1.0 or HTTP/1.1. Little legitimate need for processing HTTP 1 requests with ambiguous version numbers. Broadly refuse. Co-authored-by: Ben Kallus <benjamin.p.kallus.gr@dartmouth.edu>
Configuration menu - View commit details
-
Copy full SHA for 7ebe442 - Browse repository at this point
Copy the full SHA 7ebe442View commit details -
briefly document security fixes in 2023 news
further information to be published in security advisories, published out of tree on Github
Configuration menu - View commit details
-
Copy full SHA for b6c7414 - Browse repository at this point
Copy the full SHA b6c7414View commit details
Commits on Dec 17, 2023
-
HTTP parser: stricter chunk-ext OBS handling
chunk extensions are silently ignored before and after this change; its just the whitespace handling for the case without extensions that matters applying same strip(WS)->rstrip(BWS) replacement as already done in related cases half-way fix: could probably reject all BWS cases, rejecting only misplaced ones
Configuration menu - View commit details
-
Copy full SHA for e710393 - Browse repository at this point
Copy the full SHA e710393View commit details